2d301d12fcecf446f6f0ba8d7a58bec45b92f328
[openssl.git] / providers / common / capabilities.c
1 /*
2  * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9
10 #include <assert.h>
11 #include <string.h>
12 #include <openssl/core_numbers.h>
13 #include <openssl/core_names.h>
14 /* For TLS1_VERSION etc */
15 #include <openssl/ssl.h>
16 #include <openssl/params.h>
17 #include "internal/nelem.h"
18 #include "prov/providercommon.h"
19
20 typedef struct tls_group_constants_st {
21     unsigned int group_id;   /* Group ID */
22     unsigned int secbits;    /* Bits of security */
23     int mintls;              /* Minimum TLS version, -1 unsupported */
24     int maxtls;              /* Maximum TLS version (or 0 for undefined) */
25     int mindtls;             /* Minimum DTLS version, -1 unsupported */
26     int maxdtls;             /* Maximum DTLS version (or 0 for undefined) */
27 } TLS_GROUP_CONSTANTS;
28
29 static const TLS_GROUP_CONSTANTS group_list[35] = {
30     { /* sect163k1 */ 0x0001, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
31     { /* sect163r1 */ 0x0002, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
32     { /* sect163r2 */ 0x0003, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
33     { /* sect193r1 */ 0x0004, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
34     { /* sect193r2 */ 0x0005, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
35     { /* sect233k1 */ 0x0006, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
36     { /* sect233r1 */ 0x0007, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
37     { /* sect239k1 */ 0x0008, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
38     { /* sect283k1 */ 0x0009, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
39     { /* sect283r1 */ 0x000A, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
40     { /* sect409k1 */ 0x000B, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
41     { /* sect409r1 */ 0x000C, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
42     { /* sect571k1 */ 0x000D, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
43     { /* sect571r1 */ 0x000E, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
44     { /* secp160k1 */ 0x000F, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
45     { /* secp160r1 */ 0x0010, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
46     { /* secp160r2 */ 0x0011, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
47     { /* secp192k1 */ 0x0012, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
48     { /* secp192r1 */ 0x0013, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
49     { /* secp224k1 */ 0x0014, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
50     { /* secp224r1 */ 0x0015, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
51     { /* secp256k1 */ 0x0016, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
52     { /* secp256r1 */ 0x0017, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
53     { /* secp384r1 */ 0x0018, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
54     { /* secp521r1 */ 0x0019, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
55     { /* brainpoolP256r1 */ 0x001A, 128, TLS1_VERSION, TLS1_2_VERSION, DTLS1_VERSION, DTLS1_2_VERSION },
56     { /* brainpoolP384r1 */ 0x001B, 192, TLS1_VERSION, TLS1_2_VERSION, DTLS1_VERSION, DTLS1_2_VERSION },
57     { /* brainpoolP512r1 */ 0x001C, 256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_VERSION, DTLS1_2_VERSION },
58     { /* x25519 */ 0x001D, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
59     { /* x448 */ 0x001E, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
60     /* Security bit values as given by BN_security_bits() */
61     { /* ffdhe2048 */ 0x0100, 112, TLS1_3_VERSION, 0, -1, -1 },
62     { /* ffdhe3072 */ 0x0101, 128, TLS1_3_VERSION, 0, -1, -1 },
63     { /* ffdhe4096 */ 0x0102, 128, TLS1_3_VERSION, 0, -1, -1 },
64     { /* ffdhe6144 */ 0x0103, 128, TLS1_3_VERSION, 0, -1, -1 },
65     { /* ffdhe8192 */ 0x0104, 192, TLS1_3_VERSION, 0, -1, -1 },
66 };
67
68 #define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \
69     { \
70         OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \
71                                tlsname, \
72                                sizeof(tlsname)), \
73         OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \
74                                realname, \
75                                sizeof(realname)), \
76         OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \
77                                algorithm, \
78                                sizeof(algorithm)), \
79         OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \
80                         (unsigned int *)&group_list[idx].group_id), \
81         OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \
82                         (unsigned int *)&group_list[idx].secbits), \
83         OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \
84                         (unsigned int *)&group_list[idx].mintls), \
85         OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \
86                         (unsigned int *)&group_list[idx].maxtls), \
87         OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \
88                         (unsigned int *)&group_list[idx].mindtls), \
89         OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \
90                         (unsigned int *)&group_list[idx].maxdtls), \
91         OSSL_PARAM_END \
92     }
93
94 static const OSSL_PARAM param_group_list[][10] = {
95 #ifndef OPENSSL_NO_EC
96     TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
97 # ifndef FIPS_MODULE
98     TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
99 # endif
100     TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
101 # ifndef FIPS_MODULE
102     TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
103     TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4),
104 # endif
105     TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
106     TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
107 # ifndef FIPS_MODULE
108     TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
109 # endif
110     TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
111     TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
112     TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
113     TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
114     TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
115     TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
116 # ifndef FIPS_MODULE
117     TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
118     TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15),
119     TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16),
120     TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
121 # endif
122     TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
123 # ifndef FIPS_MODULE
124     TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
125 # endif
126     TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
127 # ifndef FIPS_MODULE
128     TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
129 # endif
130     TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
131     TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
132     TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
133 # ifndef FIPS_MODULE
134     TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
135     TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
136     TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
137 # endif
138     TLS_GROUP_ENTRY("x25519", "x25519", "X25519", 28),
139     TLS_GROUP_ENTRY("x448", "x448", "X448", 29),
140 #endif /* OPENSSL_NO_EC */
141 #ifndef OPENSSL_NO_DH
142     /* Security bit values for FFDHE groups are as per RFC 7919 */
143     TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30),
144     TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31),
145     TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32),
146     TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33),
147     TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34),
148 #endif
149 };
150
151 static int tls_group_capability(OSSL_CALLBACK *cb, void *arg)
152 {
153     size_t i;
154
155 #if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH) && !defined(FIPS_MODULE)
156     assert(OSSL_NELEM(param_group_list) == OSSL_NELEM(group_list));
157 #endif
158     for (i = 0; i < OSSL_NELEM(param_group_list); i++)
159         if (!cb(param_group_list[i], arg))
160             return 0;
161
162     return 1;
163 }
164
165 int provider_get_capabilities(void *provctx, const char *capability,
166                               OSSL_CALLBACK *cb, void *arg)
167 {
168     if (strcmp(capability, "TLS-GROUP") == 0)
169         return tls_group_capability(cb, arg);
170
171     /* We don't support this capability */
172     return 0;
173 }